PT-2026-4499 · Unknown · Lavalite Cms

Abigowl · Published 2026-01-23 · Updated 2026-01-24 · CVE-2025-71177

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions up to and including 10.1.0

Description LavaLite CMS is affected by a stored cross-site scripting issue in the package creation and search functionality. Authenticated users can inject crafted HTML or JavaScript into the Name or Description fields during package creation. This malicious content is stored and subsequently displayed without proper output encoding when other users view package search results, leading to script execution in their browsers. This could allow for session hijacking, credential theft, and unauthorized actions.

Recommendations Versions prior to 10.1.0 should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-71177

GHSA-W7RQ-FGX4-4XCM

Affected Products

Lavalite Cms

References · 11

• 🔥 https://github.com/LavaLite/cms/issues/420 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-71177 · Security Note
• https://osv.dev/vulnerability/GHSA-w7rq-fgx4-4xcm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71177 · Vendor Advisory
• https://github.com/LavaLite/cms · Note
• https://t.me/CVEtracker/42872 · Telegram Post
• https://lavalite.org · Note
• https://twitter.com/CVEnew/status/2014995847373877492 · Twitter Post
• https://twitter.com/_cvereports/status/2014868326002970915 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014868219811565878 · Twitter Post
• https://vulncheck.com/advisories/lavalite-cms-stored-xss-via-package-creation-and-search · Note